@replohq/sdk 0.10.0 → 0.13.0

package/cart/gateways/cart-constants.js

@@ -1,5 +1,27 @@
 const REPLO_CART_COOKIE_NAME = "replo_cart_v2";
+function getCartCookieOptions() {
+  const sharedOptions = {
+    maxAge: 60 * 60 * 24 * 30,
+    // 30 days
+    httpOnly: true,
+    path: "/"
+  };
+  if (process.env.IS_REPLO_SANDBOX) {
+    return {
+      ...sharedOptions,
+      secure: true,
+      sameSite: "none",
+      partitioned: true
+    };
+  }
+  return {
+    ...sharedOptions,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax"
+  };
+}
 export {
-  REPLO_CART_COOKIE_NAME
+  REPLO_CART_COOKIE_NAME,
+  getCartCookieOptions
 };
 //# sourceMappingURL=cart-constants.js.map

package/cart/gateways/cart-constants.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../cart/gateways/cart-constants.ts"],
-  "sourcesContent": ["// NOTE (Max, 2026-07-21): the cookie holds the native Replo cart \u2014 the Stripe and\n// default gateways both use it, so the checkout provider is incidental to the name.\n// NOTE (Max, 2026-07-31): the `_v2` suffix retires cookies written before the\n// integer-minor-units flip (REPL-30044). A pre-flip cookie holds decimal\n// major-unit prices; reading it under the new SDK would reinterpret 19.99 as 19\n// minor units. The persisted cart carries no schema version, so the name is the\n// version \u2014 a bumped name abandons stale carts (they expire in 30d) instead of\n// silently rescaling them.\nexport const REPLO_CART_COOKIE_NAME = \"replo_cart_v2\";\n"],
-  "mappings": "AAQO,MAAM,yBAAyB;",
+  "sourcesContent": ["// NOTE (Max, 2026-07-21): the cookie holds the native Replo cart \u2014 the Stripe and\n// default gateways both use it, so the checkout provider is incidental to the name.\n// NOTE (Max, 2026-07-31): the `_v2` suffix retires cookies written before the\n// integer-minor-units flip (REPL-30044). A pre-flip cookie holds decimal\n// major-unit prices; reading it under the new SDK would reinterpret 19.99 as 19\n// minor units. The persisted cart carries no schema version, so the name is the\n// version \u2014 a bumped name abandons stale carts (they expire in 30d) instead of\n// silently rescaling them.\nexport const REPLO_CART_COOKIE_NAME = \"replo_cart_v2\";\n\n// NOTE (Max, 2026-08-25): Only the Replo sandbox renders the storefront inside\n// a cross-origin iframe (the dashboard preview), where a SameSite=Lax cookie is\n// neither sent nor set \u2014 every cart server action then runs with no cart and\n// returns null. Gate the cross-site attributes (SameSite=None + Secure, with\n// Partitioned to survive third-party-cookie blocking; same treatment as the\n// preview session cookie in cloudflare-daytona-proxy, REPL-26727) to the\n// sandbox, so published storefronts keep the Lax default: shoppers keep the\n// browser-level CSRF backstop and their existing cart cookies stay in the same\n// cookie jar.\nexport function getCartCookieOptions() {\n  const sharedOptions = {\n    maxAge: 60 * 60 * 24 * 30, // 30 days\n    httpOnly: true,\n    path: \"/\",\n  } as const;\n  if (process.env.IS_REPLO_SANDBOX) {\n    return {\n      ...sharedOptions,\n      secure: true,\n      sameSite: \"none\",\n      partitioned: true,\n    } as const;\n  }\n  return {\n    ...sharedOptions,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\",\n  } as const;\n}\n"],
+  "mappings": "AAQO,MAAM,yBAAyB;AAW/B,SAAS,uBAAuB;AACrC,QAAM,gBAAgB;AAAA,IACpB,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,IACvB,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACA,MAAI,QAAQ,IAAI,kBAAkB;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,EACZ;AACF;",
   "names": []
 }

package/cart/storefront-urls.d.ts

@@ -0,0 +1,10 @@
+export declare function getStorefrontUrls({ host, forwardedHost, forwardedProto, requestOrigin, pageUrl, }: {
+    host: string;
+    forwardedHost: string | null;
+    forwardedProto: string | null;
+    requestOrigin: string | null;
+    pageUrl: string;
+}): {
+    origin: string;
+    cancelUrl: string;
+};

package/cart/storefront-urls.js

@@ -0,0 +1,44 @@
+function firstHeaderValue(value) {
+  const firstValue = value?.split(",")[0]?.trim();
+  return firstValue ? firstValue : null;
+}
+function parseOrigin(value) {
+  if (!value) {
+    return null;
+  }
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+function getStorefrontUrls({
+  host,
+  forwardedHost,
+  forwardedProto,
+  requestOrigin,
+  pageUrl
+}) {
+  const protocol = firstHeaderValue(forwardedProto) === "http" ? "http" : "https";
+  const proxyHost = firstHeaderValue(forwardedHost) ?? host;
+  const fallbackOrigin = `${protocol}://${proxyHost}`;
+  const trustedOrigins = /* @__PURE__ */ new Set([
+    fallbackOrigin,
+    parseOrigin(firstHeaderValue(requestOrigin))
+  ]);
+  try {
+    const parsedPageUrl = new URL(pageUrl);
+    if (trustedOrigins.has(parsedPageUrl.origin)) {
+      return {
+        origin: parsedPageUrl.origin,
+        cancelUrl: parsedPageUrl.toString()
+      };
+    }
+  } catch {
+  }
+  return { origin: fallbackOrigin, cancelUrl: fallbackOrigin };
+}
+export {
+  getStorefrontUrls
+};
+//# sourceMappingURL=storefront-urls.js.map

package/cart/storefront-urls.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../cart/storefront-urls.ts"],
+  "sourcesContent": ["function firstHeaderValue(value: string | null) {\n  const firstValue = value?.split(\",\")[0]?.trim();\n  return firstValue ? firstValue : null;\n}\n\nfunction parseOrigin(value: string | null) {\n  if (!value) {\n    return null;\n  }\n\n  try {\n    return new URL(value).origin;\n  } catch {\n    return null;\n  }\n}\n\nexport function getStorefrontUrls({\n  host,\n  forwardedHost,\n  forwardedProto,\n  requestOrigin,\n  pageUrl,\n}: {\n  host: string;\n  forwardedHost: string | null;\n  forwardedProto: string | null;\n  requestOrigin: string | null;\n  pageUrl: string;\n}) {\n  const protocol =\n    firstHeaderValue(forwardedProto) === \"http\" ? \"http\" : \"https\";\n  const proxyHost = firstHeaderValue(forwardedHost) ?? host;\n  const fallbackOrigin = `${protocol}://${proxyHost}`;\n  const trustedOrigins = new Set([\n    fallbackOrigin,\n    parseOrigin(firstHeaderValue(requestOrigin)),\n  ]);\n\n  try {\n    const parsedPageUrl = new URL(pageUrl);\n    if (trustedOrigins.has(parsedPageUrl.origin)) {\n      return {\n        origin: parsedPageUrl.origin,\n        cancelUrl: parsedPageUrl.toString(),\n      };\n    }\n  } catch {\n    // The server-derived fallback below remains the only trusted destination.\n  }\n\n  return { origin: fallbackOrigin, cancelUrl: fallbackOrigin };\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB,OAAsB;AAC9C,QAAM,aAAa,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9C,SAAO,aAAa,aAAa;AACnC;AAEA,SAAS,YAAY,OAAsB;AACzC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,WACJ,iBAAiB,cAAc,MAAM,SAAS,SAAS;AACzD,QAAM,YAAY,iBAAiB,aAAa,KAAK;AACrD,QAAM,iBAAiB,GAAG,QAAQ,MAAM,SAAS;AACjD,QAAM,iBAAiB,oBAAI,IAAI;AAAA,IAC7B;AAAA,IACA,YAAY,iBAAiB,aAAa,CAAC;AAAA,EAC7C,CAAC;AAED,MAAI;AACF,UAAM,gBAAgB,IAAI,IAAI,OAAO;AACrC,QAAI,eAAe,IAAI,cAAc,MAAM,GAAG;AAC5C,aAAO;AAAA,QACL,QAAQ,cAAc;AAAA,QACtB,WAAW,cAAc,SAAS;AAAA,MACpC;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,EAAE,QAAQ,gBAAgB,WAAW,eAAe;AAC7D;",
+  "names": []
+}

package/cart/utils/cart-utils.d.ts

@@ -11,6 +11,14 @@ export interface CartTotals {
  * server-computed cost to rely on.
  */
 export declare function calculateLineItemsSubtotal(lineItems: CartLine[]): number;
+/**
+ * Recompute a cart's cost from its line items. Cookie carts are their own source
+ * of truth (no server roundtrip) and apply no cart-level discounts, so subtotal
+ * equals total. Without this the cost stays at the 0 it was created with, and
+ * every consumer that trusts it (cart total, checkout analytics) reports $0 for
+ * a priced cart.
+ */
+export declare function recalculateCartCost(cart: Cart): Cart;
 /**
  * Calculate cart totals including subtotal, discounts, and final total.
  * When cart cost data is provided (from Shopify), uses the actual totalAmount

package/cart/utils/cart-utils.js

@@ -6,6 +6,17 @@ function calculateLineItemsSubtotal(lineItems) {
     0
   );
 }
+function recalculateCartCost(cart) {
+  const subtotal = calculateLineItemsSubtotal(cart.lines);
+  return {
+    ...cart,
+    cost: {
+      ...cart.cost,
+      subtotalAmount: subtotal,
+      totalAmount: subtotal
+    }
+  };
+}
 function calculateCartTotals({
   lineItems,
   cart
@@ -41,6 +52,7 @@ export {
   calculateCartTotals,
   calculateLineItemsSubtotal,
   formatPrice,
-  formatSellingPlanId
+  formatSellingPlanId,
+  recalculateCartCost
 };
 //# sourceMappingURL=cart-utils.js.map

package/cart/utils/cart-utils.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../cart/utils/cart-utils.ts"],
-  "sourcesContent": ["import type { Cart, CartLine } from \"../cart-types\";\n\nimport { formatAmount } from \"schemas/money\";\n\nimport { getCartLinePricing } from \"./variant-to-cart-line\";\n\nexport interface CartTotals {\n  subtotal: number;\n  discountAmount: number;\n  totalSavings: number;\n  total: number;\n}\n\n/**\n * Sum the final (post selling-plan) price of every line item in the cart.\n * This is the authoritative subtotal for cookie-based carts, which have no\n * server-computed cost to rely on.\n */\nexport function calculateLineItemsSubtotal(lineItems: CartLine[]): number {\n  return lineItems.reduce(\n    (sum, item) => sum + getCartLinePricing(item).finalPrice * item.quantity,\n    0,\n  );\n}\n\n/**\n * Calculate cart totals including subtotal, discounts, and final total.\n * When cart cost data is provided (from Shopify), uses the actual totalAmount\n * which includes cart-level discounts from discount codes.\n *\n * @param options - Object containing lineItems and cart\n * @param options.lineItems - Array of cart line items\n * @param options.cart - Optional cart data from Shopify (includes discount codes)\n */\nexport function calculateCartTotals({\n  lineItems,\n  cart,\n}: {\n  lineItems: CartLine[];\n  cart: Cart | null;\n}): CartTotals {\n  const lineItemSubtotal = calculateLineItemsSubtotal(lineItems);\n  const compareAtSubtotal = lineItems.reduce((sum, item) => {\n    return sum + getCartLinePricing(item).compareAtPrice * item.quantity;\n  }, 0);\n\n  // NOTE (Jasmine, 2026-07-22): Trust the provider's authoritative cost when\n  // present. For Shopify this is the server-computed cart cost (including a\n  // legitimate $0 when items aren't purchasable), which we must not\n  // second-guess; cookie carts keep their cost truthful via\n  // cookie-cart-persistence.ts.\n  const total = cart?.cost.totalAmount ?? lineItemSubtotal;\n\n  // If we have provider cost data, use subtotalAmount which doesn't include discounts\n  const actualSubtotal = cart?.cost.subtotalAmount ?? lineItemSubtotal;\n  const discountAmount = actualSubtotal - total;\n\n  const totalSavings = compareAtSubtotal - total;\n\n  return {\n    subtotal: lineItemSubtotal,\n    discountAmount,\n    totalSavings,\n    total,\n  };\n}\n\n/**\n * @deprecated Back-compat shim kept for surface parity with canopy-sdk, so\n * sites migrating off `import { formatPrice } from\n * \"canopy-sdk/cart/utils/cart-utils\"` keep rendering with only the package\n * specifier renamed. It formats INTEGER MINOR UNITS \u2014 the units every cart\n * value uses (`calculateCartTotals`, `getCartLinePricing`, `CartCost`):\n * passing 1999 yields \"$19.99\", not \"$1,999.00\". New code should call\n * `formatAmount({ amount, currencyCode })` from `@replohq/sdk/money` directly.\n */\nexport function formatPrice(price: number, currency: string = \"USD\"): string {\n  return formatAmount({ amount: price, currencyCode: currency });\n}\n\n/**\n * Validates and formats a Shopify selling plan ID to ensure it has the correct GID format.\n *\n * @param sellingPlanId - The selling plan ID to validate and format\n * @returns The formatted selling plan ID with GID prefix, or null if no ID provided\n */\nexport function formatSellingPlanId(\n  sellingPlanId: string | null | undefined,\n): string | null {\n  if (!sellingPlanId) {\n    return null;\n  }\n\n  // Check if it already has the gid format\n  if (sellingPlanId.startsWith(\"gid://shopify/SellingPlan/\")) {\n    return sellingPlanId;\n  }\n\n  // If it doesn't have the gid format, prepend it\n  return `gid://shopify/SellingPlan/${sellingPlanId}`;\n}\n"],
-  "mappings": "AAEA,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AAc5B,SAAS,2BAA2B,WAA+B;AACxE,SAAO,UAAU;AAAA,IACf,CAAC,KAAK,SAAS,MAAM,mBAAmB,IAAI,EAAE,aAAa,KAAK;AAAA,IAChE;AAAA,EACF;AACF;AAWO,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA;AACF,GAGe;AACb,QAAM,mBAAmB,2BAA2B,SAAS;AAC7D,QAAM,oBAAoB,UAAU,OAAO,CAAC,KAAK,SAAS;AACxD,WAAO,MAAM,mBAAmB,IAAI,EAAE,iBAAiB,KAAK;AAAA,EAC9D,GAAG,CAAC;AAOJ,QAAM,QAAQ,MAAM,KAAK,eAAe;AAGxC,QAAM,iBAAiB,MAAM,KAAK,kBAAkB;AACpD,QAAM,iBAAiB,iBAAiB;AAExC,QAAM,eAAe,oBAAoB;AAEzC,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAWO,SAAS,YAAY,OAAe,WAAmB,OAAe;AAC3E,SAAO,aAAa,EAAE,QAAQ,OAAO,cAAc,SAAS,CAAC;AAC/D;AAQO,SAAS,oBACd,eACe;AACf,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,WAAW,4BAA4B,GAAG;AAC1D,WAAO;AAAA,EACT;AAGA,SAAO,6BAA6B,aAAa;AACnD;",
+  "sourcesContent": ["import type { Cart, CartLine } from \"../cart-types\";\n\nimport { formatAmount } from \"schemas/money\";\n\nimport { getCartLinePricing } from \"./variant-to-cart-line\";\n\nexport interface CartTotals {\n  subtotal: number;\n  discountAmount: number;\n  totalSavings: number;\n  total: number;\n}\n\n/**\n * Sum the final (post selling-plan) price of every line item in the cart.\n * This is the authoritative subtotal for cookie-based carts, which have no\n * server-computed cost to rely on.\n */\nexport function calculateLineItemsSubtotal(lineItems: CartLine[]): number {\n  return lineItems.reduce(\n    (sum, item) => sum + getCartLinePricing(item).finalPrice * item.quantity,\n    0,\n  );\n}\n\n/**\n * Recompute a cart's cost from its line items. Cookie carts are their own source\n * of truth (no server roundtrip) and apply no cart-level discounts, so subtotal\n * equals total. Without this the cost stays at the 0 it was created with, and\n * every consumer that trusts it (cart total, checkout analytics) reports $0 for\n * a priced cart.\n */\nexport function recalculateCartCost(cart: Cart): Cart {\n  const subtotal = calculateLineItemsSubtotal(cart.lines);\n  return {\n    ...cart,\n    cost: {\n      ...cart.cost,\n      subtotalAmount: subtotal,\n      totalAmount: subtotal,\n    },\n  };\n}\n\n/**\n * Calculate cart totals including subtotal, discounts, and final total.\n * When cart cost data is provided (from Shopify), uses the actual totalAmount\n * which includes cart-level discounts from discount codes.\n *\n * @param options - Object containing lineItems and cart\n * @param options.lineItems - Array of cart line items\n * @param options.cart - Optional cart data from Shopify (includes discount codes)\n */\nexport function calculateCartTotals({\n  lineItems,\n  cart,\n}: {\n  lineItems: CartLine[];\n  cart: Cart | null;\n}): CartTotals {\n  const lineItemSubtotal = calculateLineItemsSubtotal(lineItems);\n  const compareAtSubtotal = lineItems.reduce((sum, item) => {\n    return sum + getCartLinePricing(item).compareAtPrice * item.quantity;\n  }, 0);\n\n  // NOTE (Jasmine, 2026-07-22): Trust the provider's authoritative cost when\n  // present. For Shopify this is the server-computed cart cost (including a\n  // legitimate $0 when items aren't purchasable), which we must not\n  // second-guess; cookie carts keep their cost truthful via\n  // cookie-cart-persistence.ts.\n  const total = cart?.cost.totalAmount ?? lineItemSubtotal;\n\n  // If we have provider cost data, use subtotalAmount which doesn't include discounts\n  const actualSubtotal = cart?.cost.subtotalAmount ?? lineItemSubtotal;\n  const discountAmount = actualSubtotal - total;\n\n  const totalSavings = compareAtSubtotal - total;\n\n  return {\n    subtotal: lineItemSubtotal,\n    discountAmount,\n    totalSavings,\n    total,\n  };\n}\n\n/**\n * @deprecated Back-compat shim kept for surface parity with canopy-sdk, so\n * sites migrating off `import { formatPrice } from\n * \"canopy-sdk/cart/utils/cart-utils\"` keep rendering with only the package\n * specifier renamed. It formats INTEGER MINOR UNITS \u2014 the units every cart\n * value uses (`calculateCartTotals`, `getCartLinePricing`, `CartCost`):\n * passing 1999 yields \"$19.99\", not \"$1,999.00\". New code should call\n * `formatAmount({ amount, currencyCode })` from `@replohq/sdk/money` directly.\n */\nexport function formatPrice(price: number, currency: string = \"USD\"): string {\n  return formatAmount({ amount: price, currencyCode: currency });\n}\n\n/**\n * Validates and formats a Shopify selling plan ID to ensure it has the correct GID format.\n *\n * @param sellingPlanId - The selling plan ID to validate and format\n * @returns The formatted selling plan ID with GID prefix, or null if no ID provided\n */\nexport function formatSellingPlanId(\n  sellingPlanId: string | null | undefined,\n): string | null {\n  if (!sellingPlanId) {\n    return null;\n  }\n\n  // Check if it already has the gid format\n  if (sellingPlanId.startsWith(\"gid://shopify/SellingPlan/\")) {\n    return sellingPlanId;\n  }\n\n  // If it doesn't have the gid format, prepend it\n  return `gid://shopify/SellingPlan/${sellingPlanId}`;\n}\n"],
+  "mappings": "AAEA,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AAc5B,SAAS,2BAA2B,WAA+B;AACxE,SAAO,UAAU;AAAA,IACf,CAAC,KAAK,SAAS,MAAM,mBAAmB,IAAI,EAAE,aAAa,KAAK;AAAA,IAChE;AAAA,EACF;AACF;AASO,SAAS,oBAAoB,MAAkB;AACpD,QAAM,WAAW,2BAA2B,KAAK,KAAK;AACtD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,MAAM;AAAA,MACJ,GAAG,KAAK;AAAA,MACR,gBAAgB;AAAA,MAChB,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAWO,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA;AACF,GAGe;AACb,QAAM,mBAAmB,2BAA2B,SAAS;AAC7D,QAAM,oBAAoB,UAAU,OAAO,CAAC,KAAK,SAAS;AACxD,WAAO,MAAM,mBAAmB,IAAI,EAAE,iBAAiB,KAAK;AAAA,EAC9D,GAAG,CAAC;AAOJ,QAAM,QAAQ,MAAM,KAAK,eAAe;AAGxC,QAAM,iBAAiB,MAAM,KAAK,kBAAkB;AACpD,QAAM,iBAAiB,iBAAiB;AAExC,QAAM,eAAe,oBAAoB;AAEzC,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAWO,SAAS,YAAY,OAAe,WAAmB,OAAe;AAC3E,SAAO,aAAa,EAAE,QAAQ,OAAO,cAAc,SAAS,CAAC;AAC/D;AAQO,SAAS,oBACd,eACe;AACf,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,WAAW,4BAA4B,GAAG;AAC1D,WAAO;AAAA,EACT;AAGA,SAAO,6BAA6B,aAAa;AACnD;",
   "names": []
 }

package/cart/utils/cookie-cart-persistence.js

@@ -1,27 +1,10 @@
 "use server";
 import { cookies } from "next/headers";
-import { calculateLineItemsSubtotal } from "./cart-utils";
-const CART_COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
-function recalculateCartCost(cart) {
-  const subtotal = calculateLineItemsSubtotal(cart.lines);
-  return {
-    ...cart,
-    cost: {
-      ...cart.cost,
-      subtotalAmount: subtotal,
-      totalAmount: subtotal
-    }
-  };
-}
+import { getCartCookieOptions } from "../gateways/cart-constants";
+import { recalculateCartCost } from "./cart-utils";
 async function saveCartToCookie(cart, cookieName) {
   const cookieStore = await cookies();
-  cookieStore.set(cookieName, JSON.stringify(cart), {
-    maxAge: CART_COOKIE_MAX_AGE,
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    path: "/"
-  });
+  cookieStore.set(cookieName, JSON.stringify(cart), getCartCookieOptions());
 }
 async function loadCartFromCookie(cookieName) {
   const cookieStore = await cookies();
@@ -39,7 +22,7 @@ async function loadCartFromCookie(cookieName) {
 }
 async function clearCartCookie(cookieName) {
   const cookieStore = await cookies();
-  cookieStore.delete(cookieName);
+  cookieStore.set(cookieName, "", { ...getCartCookieOptions(), maxAge: 0 });
 }
 async function updateCartInCookie(cartId, cookieName, updater) {
   const existingCart = await loadCartFromCookie(cookieName);

package/cart/utils/cookie-cart-persistence.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../cart/utils/cookie-cart-persistence.ts"],
-  "sourcesContent": ["\"use server\";\n\nimport type {\n  AddToCartPayload,\n  Cart,\n  CartLine,\n  CartLinePayload,\n  RemoveFromCartPayload,\n  UpdateCartLineItemPayload,\n} from \"../cart-types\";\n\nimport { cookies } from \"next/headers\";\n\nimport { calculateLineItemsSubtotal } from \"./cart-utils\";\n\nconst CART_COOKIE_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\n\n// NOTE (Jasmine, 2026-07-22): Cookie carts are their own source of truth (no\n// server roundtrip), so recompute cost from line items on every mutation.\n// Without this the persisted cost stays at its initial 0 and every consumer\n// that trusts it (cart total, checkout analytics) reports $0 for a priced cart.\n// Cookie carts apply no cart-level discounts, so subtotal equals total.\nfunction recalculateCartCost(cart: Cart): Cart {\n  const subtotal = calculateLineItemsSubtotal(cart.lines);\n  return {\n    ...cart,\n    cost: {\n      ...cart.cost,\n      subtotalAmount: subtotal,\n      totalAmount: subtotal,\n    },\n  };\n}\n\n/**\n * Line merge function type - returns index of existing line to merge with, or -1 to add as new line\n */\nexport type LineMergeFn = (\n  existingLines: CartLine[],\n  newLine: CartLinePayload,\n) => number;\n\n/**\n * Options for creating a cart with persistence\n */\ninterface CreateCartOptions {\n  cookieName: string;\n  lines?: CartLinePayload[];\n  lineIdGenerator: () => string;\n  cartIdGenerator: () => string;\n}\n\n/**\n * Options for adding to cart with persistence\n */\ninterface AddToCartOptions {\n  cookieName: string;\n  mergeFn: LineMergeFn;\n  lineIdGenerator: () => string;\n}\n\n/**\n * Save cart to cookie\n */\nexport async function saveCartToCookie(cart: Cart, cookieName: string) {\n  const cookieStore = await cookies();\n  cookieStore.set(cookieName, JSON.stringify(cart), {\n    maxAge: CART_COOKIE_MAX_AGE,\n    httpOnly: true,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\",\n    path: \"/\",\n  });\n}\n\n/**\n * Load cart from cookie\n */\nexport async function loadCartFromCookie(\n  cookieName: string,\n): Promise<Cart | null> {\n  const cookieStore = await cookies();\n  const cartCookie = cookieStore.get(cookieName);\n\n  if (!cartCookie?.value) {\n    return null;\n  }\n\n  try {\n    // Legacy cast - may or may not be necessary\n    // eslint-disable-next-line replo/no-as-cast\n    return JSON.parse(cartCookie.value) as Cart;\n  } catch (error) {\n    console.warn(\"Failed to parse cart cookie:\", error);\n    await clearCartCookie(cookieName);\n    return null;\n  }\n}\n\n/**\n * Clear cart cookie\n */\nexport async function clearCartCookie(cookieName: string) {\n  const cookieStore = await cookies();\n  cookieStore.delete(cookieName);\n}\n\n/**\n * Update cart in cookie atomically (load-transform-save pattern)\n */\nexport async function updateCartInCookie(\n  cartId: string,\n  cookieName: string,\n  updater: (cart: Cart) => Cart,\n): Promise<Cart | null> {\n  const existingCart = await loadCartFromCookie(cookieName);\n\n  if (!existingCart || existingCart.id !== cartId) {\n    return null;\n  }\n\n  const updatedCart = recalculateCartCost(updater(existingCart));\n\n  await saveCartToCookie(updatedCart, cookieName);\n\n  return updatedCart;\n}\n\n/**\n * Create a new cart with persistence\n */\nexport async function createCartWithPersistence(\n  options: CreateCartOptions,\n): Promise<Cart | null> {\n  const cartId = options.cartIdGenerator();\n\n  const cart: Cart = {\n    id: cartId,\n    lines: [],\n    cost: {\n      subtotalAmount: 0,\n      totalAmount: 0,\n      currencyCode: \"USD\",\n    },\n    checkoutUrl: \"/checkout\",\n  };\n\n  for (const line of options.lines ?? []) {\n    cart.lines.push(\n      convertCartLinePayloadToCartLine(line, options.lineIdGenerator),\n    );\n  }\n\n  const cartWithCost = recalculateCartCost(cart);\n  await saveCartToCookie(cartWithCost, options.cookieName);\n  return cartWithCost;\n}\n\n/**\n * Add lines to cart with configurable line merging strategy\n */\nexport async function addToCartWithPersistence(\n  payload: AddToCartPayload,\n  options: AddToCartOptions,\n): Promise<Cart | null> {\n  return await updateCartInCookie(\n    payload.cartId,\n    options.cookieName,\n    (cart) => {\n      for (const linePayload of payload.lines) {\n        const existingLineIndex = options.mergeFn(cart.lines, linePayload);\n\n        if (existingLineIndex >= 0) {\n          cart.lines[existingLineIndex]!.quantity += linePayload.quantity;\n        } else {\n          const newLine: CartLine = convertCartLinePayloadToCartLine(\n            linePayload,\n            options.lineIdGenerator,\n          );\n          cart.lines.push(newLine);\n        }\n      }\n\n      return cart;\n    },\n  );\n}\n\n/**\n * Update cart line item\n */\nexport async function updateCartLineItemWithPersistence(\n  payload: UpdateCartLineItemPayload,\n  cookieName: string,\n): Promise<Cart | null> {\n  return await updateCartInCookie(payload.cartId, cookieName, (cart) => {\n    const lineIndex = cart.lines.findIndex(\n      (line) => line.id === payload.line.id,\n    );\n\n    if (lineIndex >= 0) {\n      if (payload.line.quantity <= 0) {\n        cart.lines.splice(lineIndex, 1);\n      } else {\n        cart.lines[lineIndex]!.quantity = payload.line.quantity;\n        if (payload.line.properties) {\n          cart.lines[lineIndex]!.attributes = payload.line.properties;\n        }\n        if (payload.line.merchandise) {\n          cart.lines[lineIndex]!.merchandise = payload.line.merchandise;\n        }\n      }\n    }\n\n    return cart;\n  });\n}\n\n/**\n * Remove cart line items\n */\nexport async function removeCartLineItemsWithPersistence(\n  payload: RemoveFromCartPayload,\n  cookieName: string,\n): Promise<Cart | null> {\n  return await updateCartInCookie(payload.cartId, cookieName, (cart) => {\n    const removeSet = new Set(payload.lineIds);\n    cart.lines = cart.lines.filter((line) => !removeSet.has(line.id));\n    return cart;\n  });\n}\n\n/**\n * Convert CartLinePayload to CartLine with custom ID generator\n */\nfunction convertCartLinePayloadToCartLine(\n  linePayload: CartLinePayload,\n  lineIdGenerator: () => string,\n): CartLine {\n  // Cookie-persisted carts (Stripe/default) are their own source of truth \u2014\n  // there's no server roundtrip to backfill merchandise later. Fall back to a\n  // placeholder when the caller didn't pass merchandise so the persisted line\n  // is renderable; otherwise an unresolvable line would render as a skeleton\n  // forever. Shopify carts hit a different code path and use the skeleton\n  // treatment in cart-provider.tsx.\n  const fallbackMerchandise = {\n    id: linePayload.id,\n    product: {\n      id: linePayload.merchandise?.product.id ?? linePayload.id,\n      title: linePayload.merchandise?.product.title ?? \"Product\",\n    },\n    title: linePayload.merchandise?.title ?? \"Product Variant\",\n    price: linePayload.merchandise?.price ?? 0,\n    compareAtPrice: linePayload.merchandise?.compareAtPrice ?? null,\n    image: linePayload.merchandise?.image\n      ? {\n          url: linePayload.merchandise.image.url,\n          altText: linePayload.merchandise.image.altText,\n        }\n      : null,\n    selectedOptions: linePayload.merchandise?.selectedOptions ?? [],\n  };\n\n  return {\n    id: lineIdGenerator(),\n    quantity: linePayload.quantity,\n    merchandise: linePayload.merchandise ?? fallbackMerchandise,\n    attributes: linePayload.properties ?? [],\n    sellingPlanAllocation: linePayload.sellingPlanId\n      ? {\n          sellingPlan: {\n            id: linePayload.sellingPlanId,\n            name: \"Subscription Plan\",\n            description: null,\n          },\n          priceAdjustments: [],\n          checkoutChargeAmount: { amount: 0, currencyCode: \"USD\" },\n          remainingBalanceChargeAmount: { amount: 0, currencyCode: \"USD\" },\n        }\n      : null,\n  };\n}\n"],
-  "mappings": ";AAWA,SAAS,eAAe;AAExB,SAAS,kCAAkC;AAE3C,MAAM,sBAAsB,KAAK,KAAK,KAAK;AAO3C,SAAS,oBAAoB,MAAkB;AAC7C,QAAM,WAAW,2BAA2B,KAAK,KAAK;AACtD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,MAAM;AAAA,MACJ,GAAG,KAAK;AAAA,MACR,gBAAgB;AAAA,MAChB,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAgCA,eAAsB,iBAAiB,MAAY,YAAoB;AACrE,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,YAAY,KAAK,UAAU,IAAI,GAAG;AAAA,IAChD,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACH;AAKA,eAAsB,mBACpB,YACsB;AACtB,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,aAAa,YAAY,IAAI,UAAU;AAE7C,MAAI,CAAC,YAAY,OAAO;AACtB,WAAO;AAAA,EACT;AAEA,MAAI;AAGF,WAAO,KAAK,MAAM,WAAW,KAAK;AAAA,EACpC,SAAS,OAAO;AACd,YAAQ,KAAK,gCAAgC,KAAK;AAClD,UAAM,gBAAgB,UAAU;AAChC,WAAO;AAAA,EACT;AACF;AAKA,eAAsB,gBAAgB,YAAoB;AACxD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,UAAU;AAC/B;AAKA,eAAsB,mBACpB,QACA,YACA,SACsB;AACtB,QAAM,eAAe,MAAM,mBAAmB,UAAU;AAExD,MAAI,CAAC,gBAAgB,aAAa,OAAO,QAAQ;AAC/C,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,oBAAoB,QAAQ,YAAY,CAAC;AAE7D,QAAM,iBAAiB,aAAa,UAAU;AAE9C,SAAO;AACT;AAKA,eAAsB,0BACpB,SACsB;AACtB,QAAM,SAAS,QAAQ,gBAAgB;AAEvC,QAAM,OAAa;AAAA,IACjB,IAAI;AAAA,IACJ,OAAO,CAAC;AAAA,IACR,MAAM;AAAA,MACJ,gBAAgB;AAAA,MAChB,aAAa;AAAA,MACb,cAAc;AAAA,IAChB;AAAA,IACA,aAAa;AAAA,EACf;AAEA,aAAW,QAAQ,QAAQ,SAAS,CAAC,GAAG;AACtC,SAAK,MAAM;AAAA,MACT,iCAAiC,MAAM,QAAQ,eAAe;AAAA,IAChE;AAAA,EACF;AAEA,QAAM,eAAe,oBAAoB,IAAI;AAC7C,QAAM,iBAAiB,cAAc,QAAQ,UAAU;AACvD,SAAO;AACT;AAKA,eAAsB,yBACpB,SACA,SACsB;AACtB,SAAO,MAAM;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,CAAC,SAAS;AACR,iBAAW,eAAe,QAAQ,OAAO;AACvC,cAAM,oBAAoB,QAAQ,QAAQ,KAAK,OAAO,WAAW;AAEjE,YAAI,qBAAqB,GAAG;AAC1B,eAAK,MAAM,iBAAiB,EAAG,YAAY,YAAY;AAAA,QACzD,OAAO;AACL,gBAAM,UAAoB;AAAA,YACxB;AAAA,YACA,QAAQ;AAAA,UACV;AACA,eAAK,MAAM,KAAK,OAAO;AAAA,QACzB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAKA,eAAsB,kCACpB,SACA,YACsB;AACtB,SAAO,MAAM,mBAAmB,QAAQ,QAAQ,YAAY,CAAC,SAAS;AACpE,UAAM,YAAY,KAAK,MAAM;AAAA,MAC3B,CAAC,SAAS,KAAK,OAAO,QAAQ,KAAK;AAAA,IACrC;AAEA,QAAI,aAAa,GAAG;AAClB,UAAI,QAAQ,KAAK,YAAY,GAAG;AAC9B,aAAK,MAAM,OAAO,WAAW,CAAC;AAAA,MAChC,OAAO;AACL,aAAK,MAAM,SAAS,EAAG,WAAW,QAAQ,KAAK;AAC/C,YAAI,QAAQ,KAAK,YAAY;AAC3B,eAAK,MAAM,SAAS,EAAG,aAAa,QAAQ,KAAK;AAAA,QACnD;AACA,YAAI,QAAQ,KAAK,aAAa;AAC5B,eAAK,MAAM,SAAS,EAAG,cAAc,QAAQ,KAAK;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAKA,eAAsB,mCACpB,SACA,YACsB;AACtB,SAAO,MAAM,mBAAmB,QAAQ,QAAQ,YAAY,CAAC,SAAS;AACpE,UAAM,YAAY,IAAI,IAAI,QAAQ,OAAO;AACzC,SAAK,QAAQ,KAAK,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC;AAChE,WAAO;AAAA,EACT,CAAC;AACH;AAKA,SAAS,iCACP,aACA,iBACU;AAOV,QAAM,sBAAsB;AAAA,IAC1B,IAAI,YAAY;AAAA,IAChB,SAAS;AAAA,MACP,IAAI,YAAY,aAAa,QAAQ,MAAM,YAAY;AAAA,MACvD,OAAO,YAAY,aAAa,QAAQ,SAAS;AAAA,IACnD;AAAA,IACA,OAAO,YAAY,aAAa,SAAS;AAAA,IACzC,OAAO,YAAY,aAAa,SAAS;AAAA,IACzC,gBAAgB,YAAY,aAAa,kBAAkB;AAAA,IAC3D,OAAO,YAAY,aAAa,QAC5B;AAAA,MACE,KAAK,YAAY,YAAY,MAAM;AAAA,MACnC,SAAS,YAAY,YAAY,MAAM;AAAA,IACzC,IACA;AAAA,IACJ,iBAAiB,YAAY,aAAa,mBAAmB,CAAC;AAAA,EAChE;AAEA,SAAO;AAAA,IACL,IAAI,gBAAgB;AAAA,IACpB,UAAU,YAAY;AAAA,IACtB,aAAa,YAAY,eAAe;AAAA,IACxC,YAAY,YAAY,cAAc,CAAC;AAAA,IACvC,uBAAuB,YAAY,gBAC/B;AAAA,MACE,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,kBAAkB,CAAC;AAAA,MACnB,sBAAsB,EAAE,QAAQ,GAAG,cAAc,MAAM;AAAA,MACvD,8BAA8B,EAAE,QAAQ,GAAG,cAAc,MAAM;AAAA,IACjE,IACA;AAAA,EACN;AACF;",
+  "sourcesContent": ["\"use server\";\n\nimport type {\n  AddToCartPayload,\n  Cart,\n  CartLine,\n  CartLinePayload,\n  RemoveFromCartPayload,\n  UpdateCartLineItemPayload,\n} from \"../cart-types\";\n\nimport { cookies } from \"next/headers\";\n\nimport { getCartCookieOptions } from \"../gateways/cart-constants\";\nimport { recalculateCartCost } from \"./cart-utils\";\n\n/**\n * Line merge function type - returns index of existing line to merge with, or -1 to add as new line\n */\nexport type LineMergeFn = (\n  existingLines: CartLine[],\n  newLine: CartLinePayload,\n) => number;\n\n/**\n * Options for creating a cart with persistence\n */\ninterface CreateCartOptions {\n  cookieName: string;\n  lines?: CartLinePayload[];\n  lineIdGenerator: () => string;\n  cartIdGenerator: () => string;\n}\n\n/**\n * Options for adding to cart with persistence\n */\ninterface AddToCartOptions {\n  cookieName: string;\n  mergeFn: LineMergeFn;\n  lineIdGenerator: () => string;\n}\n\n/**\n * Save cart to cookie\n */\nexport async function saveCartToCookie(cart: Cart, cookieName: string) {\n  const cookieStore = await cookies();\n  cookieStore.set(cookieName, JSON.stringify(cart), getCartCookieOptions());\n}\n\n/**\n * Load cart from cookie\n */\nexport async function loadCartFromCookie(\n  cookieName: string,\n): Promise<Cart | null> {\n  const cookieStore = await cookies();\n  const cartCookie = cookieStore.get(cookieName);\n\n  if (!cartCookie?.value) {\n    return null;\n  }\n\n  try {\n    // Legacy cast - may or may not be necessary\n    // eslint-disable-next-line replo/no-as-cast\n    return JSON.parse(cartCookie.value) as Cart;\n  } catch (error) {\n    console.warn(\"Failed to parse cart cookie:\", error);\n    await clearCartCookie(cookieName);\n    return null;\n  }\n}\n\n/**\n * Clear cart cookie\n */\nexport async function clearCartCookie(cookieName: string) {\n  const cookieStore = await cookies();\n  // NOTE (Max, 2026-08-25): `delete` omits Partitioned, which leaves the\n  // partitioned cookie in place \u2014 expire it with the attributes it was set with.\n  cookieStore.set(cookieName, \"\", { ...getCartCookieOptions(), maxAge: 0 });\n}\n\n/**\n * Update cart in cookie atomically (load-transform-save pattern)\n */\nexport async function updateCartInCookie(\n  cartId: string,\n  cookieName: string,\n  updater: (cart: Cart) => Cart,\n): Promise<Cart | null> {\n  const existingCart = await loadCartFromCookie(cookieName);\n\n  if (!existingCart || existingCart.id !== cartId) {\n    return null;\n  }\n\n  const updatedCart = recalculateCartCost(updater(existingCart));\n\n  await saveCartToCookie(updatedCart, cookieName);\n\n  return updatedCart;\n}\n\n/**\n * Create a new cart with persistence\n */\nexport async function createCartWithPersistence(\n  options: CreateCartOptions,\n): Promise<Cart | null> {\n  const cartId = options.cartIdGenerator();\n\n  const cart: Cart = {\n    id: cartId,\n    lines: [],\n    cost: {\n      subtotalAmount: 0,\n      totalAmount: 0,\n      currencyCode: \"USD\",\n    },\n    checkoutUrl: \"/checkout\",\n  };\n\n  for (const line of options.lines ?? []) {\n    cart.lines.push(\n      convertCartLinePayloadToCartLine(line, options.lineIdGenerator),\n    );\n  }\n\n  const cartWithCost = recalculateCartCost(cart);\n  await saveCartToCookie(cartWithCost, options.cookieName);\n  return cartWithCost;\n}\n\n/**\n * Add lines to cart with configurable line merging strategy\n */\nexport async function addToCartWithPersistence(\n  payload: AddToCartPayload,\n  options: AddToCartOptions,\n): Promise<Cart | null> {\n  return await updateCartInCookie(\n    payload.cartId,\n    options.cookieName,\n    (cart) => {\n      for (const linePayload of payload.lines) {\n        const existingLineIndex = options.mergeFn(cart.lines, linePayload);\n\n        if (existingLineIndex >= 0) {\n          cart.lines[existingLineIndex]!.quantity += linePayload.quantity;\n        } else {\n          const newLine: CartLine = convertCartLinePayloadToCartLine(\n            linePayload,\n            options.lineIdGenerator,\n          );\n          cart.lines.push(newLine);\n        }\n      }\n\n      return cart;\n    },\n  );\n}\n\n/**\n * Update cart line item\n */\nexport async function updateCartLineItemWithPersistence(\n  payload: UpdateCartLineItemPayload,\n  cookieName: string,\n): Promise<Cart | null> {\n  return await updateCartInCookie(payload.cartId, cookieName, (cart) => {\n    const lineIndex = cart.lines.findIndex(\n      (line) => line.id === payload.line.id,\n    );\n\n    if (lineIndex >= 0) {\n      if (payload.line.quantity <= 0) {\n        cart.lines.splice(lineIndex, 1);\n      } else {\n        cart.lines[lineIndex]!.quantity = payload.line.quantity;\n        if (payload.line.properties) {\n          cart.lines[lineIndex]!.attributes = payload.line.properties;\n        }\n        if (payload.line.merchandise) {\n          cart.lines[lineIndex]!.merchandise = payload.line.merchandise;\n        }\n      }\n    }\n\n    return cart;\n  });\n}\n\n/**\n * Remove cart line items\n */\nexport async function removeCartLineItemsWithPersistence(\n  payload: RemoveFromCartPayload,\n  cookieName: string,\n): Promise<Cart | null> {\n  return await updateCartInCookie(payload.cartId, cookieName, (cart) => {\n    const removeSet = new Set(payload.lineIds);\n    cart.lines = cart.lines.filter((line) => !removeSet.has(line.id));\n    return cart;\n  });\n}\n\n/**\n * Convert CartLinePayload to CartLine with custom ID generator\n */\nfunction convertCartLinePayloadToCartLine(\n  linePayload: CartLinePayload,\n  lineIdGenerator: () => string,\n): CartLine {\n  // Cookie-persisted carts (Stripe/default) are their own source of truth \u2014\n  // there's no server roundtrip to backfill merchandise later. Fall back to a\n  // placeholder when the caller didn't pass merchandise so the persisted line\n  // is renderable; otherwise an unresolvable line would render as a skeleton\n  // forever. Shopify carts hit a different code path and use the skeleton\n  // treatment in cart-provider.tsx.\n  const fallbackMerchandise = {\n    id: linePayload.id,\n    product: {\n      id: linePayload.merchandise?.product.id ?? linePayload.id,\n      title: linePayload.merchandise?.product.title ?? \"Product\",\n    },\n    title: linePayload.merchandise?.title ?? \"Product Variant\",\n    price: linePayload.merchandise?.price ?? 0,\n    compareAtPrice: linePayload.merchandise?.compareAtPrice ?? null,\n    image: linePayload.merchandise?.image\n      ? {\n          url: linePayload.merchandise.image.url,\n          altText: linePayload.merchandise.image.altText,\n        }\n      : null,\n    selectedOptions: linePayload.merchandise?.selectedOptions ?? [],\n  };\n\n  return {\n    id: lineIdGenerator(),\n    quantity: linePayload.quantity,\n    merchandise: linePayload.merchandise ?? fallbackMerchandise,\n    attributes: linePayload.properties ?? [],\n    sellingPlanAllocation: linePayload.sellingPlanId\n      ? {\n          sellingPlan: {\n            id: linePayload.sellingPlanId,\n            name: \"Subscription Plan\",\n            description: null,\n          },\n          priceAdjustments: [],\n          checkoutChargeAmount: { amount: 0, currencyCode: \"USD\" },\n          remainingBalanceChargeAmount: { amount: 0, currencyCode: \"USD\" },\n        }\n      : null,\n  };\n}\n"],
+  "mappings": ";AAWA,SAAS,eAAe;AAExB,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AAgCpC,eAAsB,iBAAiB,MAAY,YAAoB;AACrE,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,YAAY,KAAK,UAAU,IAAI,GAAG,qBAAqB,CAAC;AAC1E;AAKA,eAAsB,mBACpB,YACsB;AACtB,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,aAAa,YAAY,IAAI,UAAU;AAE7C,MAAI,CAAC,YAAY,OAAO;AACtB,WAAO;AAAA,EACT;AAEA,MAAI;AAGF,WAAO,KAAK,MAAM,WAAW,KAAK;AAAA,EACpC,SAAS,OAAO;AACd,YAAQ,KAAK,gCAAgC,KAAK;AAClD,UAAM,gBAAgB,UAAU;AAChC,WAAO;AAAA,EACT;AACF;AAKA,eAAsB,gBAAgB,YAAoB;AACxD,QAAM,cAAc,MAAM,QAAQ;AAGlC,cAAY,IAAI,YAAY,IAAI,EAAE,GAAG,qBAAqB,GAAG,QAAQ,EAAE,CAAC;AAC1E;AAKA,eAAsB,mBACpB,QACA,YACA,SACsB;AACtB,QAAM,eAAe,MAAM,mBAAmB,UAAU;AAExD,MAAI,CAAC,gBAAgB,aAAa,OAAO,QAAQ;AAC/C,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,oBAAoB,QAAQ,YAAY,CAAC;AAE7D,QAAM,iBAAiB,aAAa,UAAU;AAE9C,SAAO;AACT;AAKA,eAAsB,0BACpB,SACsB;AACtB,QAAM,SAAS,QAAQ,gBAAgB;AAEvC,QAAM,OAAa;AAAA,IACjB,IAAI;AAAA,IACJ,OAAO,CAAC;AAAA,IACR,MAAM;AAAA,MACJ,gBAAgB;AAAA,MAChB,aAAa;AAAA,MACb,cAAc;AAAA,IAChB;AAAA,IACA,aAAa;AAAA,EACf;AAEA,aAAW,QAAQ,QAAQ,SAAS,CAAC,GAAG;AACtC,SAAK,MAAM;AAAA,MACT,iCAAiC,MAAM,QAAQ,eAAe;AAAA,IAChE;AAAA,EACF;AAEA,QAAM,eAAe,oBAAoB,IAAI;AAC7C,QAAM,iBAAiB,cAAc,QAAQ,UAAU;AACvD,SAAO;AACT;AAKA,eAAsB,yBACpB,SACA,SACsB;AACtB,SAAO,MAAM;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,CAAC,SAAS;AACR,iBAAW,eAAe,QAAQ,OAAO;AACvC,cAAM,oBAAoB,QAAQ,QAAQ,KAAK,OAAO,WAAW;AAEjE,YAAI,qBAAqB,GAAG;AAC1B,eAAK,MAAM,iBAAiB,EAAG,YAAY,YAAY;AAAA,QACzD,OAAO;AACL,gBAAM,UAAoB;AAAA,YACxB;AAAA,YACA,QAAQ;AAAA,UACV;AACA,eAAK,MAAM,KAAK,OAAO;AAAA,QACzB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAKA,eAAsB,kCACpB,SACA,YACsB;AACtB,SAAO,MAAM,mBAAmB,QAAQ,QAAQ,YAAY,CAAC,SAAS;AACpE,UAAM,YAAY,KAAK,MAAM;AAAA,MAC3B,CAAC,SAAS,KAAK,OAAO,QAAQ,KAAK;AAAA,IACrC;AAEA,QAAI,aAAa,GAAG;AAClB,UAAI,QAAQ,KAAK,YAAY,GAAG;AAC9B,aAAK,MAAM,OAAO,WAAW,CAAC;AAAA,MAChC,OAAO;AACL,aAAK,MAAM,SAAS,EAAG,WAAW,QAAQ,KAAK;AAC/C,YAAI,QAAQ,KAAK,YAAY;AAC3B,eAAK,MAAM,SAAS,EAAG,aAAa,QAAQ,KAAK;AAAA,QACnD;AACA,YAAI,QAAQ,KAAK,aAAa;AAC5B,eAAK,MAAM,SAAS,EAAG,cAAc,QAAQ,KAAK;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAKA,eAAsB,mCACpB,SACA,YACsB;AACtB,SAAO,MAAM,mBAAmB,QAAQ,QAAQ,YAAY,CAAC,SAAS;AACpE,UAAM,YAAY,IAAI,IAAI,QAAQ,OAAO;AACzC,SAAK,QAAQ,KAAK,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC;AAChE,WAAO;AAAA,EACT,CAAC;AACH;AAKA,SAAS,iCACP,aACA,iBACU;AAOV,QAAM,sBAAsB;AAAA,IAC1B,IAAI,YAAY;AAAA,IAChB,SAAS;AAAA,MACP,IAAI,YAAY,aAAa,QAAQ,MAAM,YAAY;AAAA,MACvD,OAAO,YAAY,aAAa,QAAQ,SAAS;AAAA,IACnD;AAAA,IACA,OAAO,YAAY,aAAa,SAAS;AAAA,IACzC,OAAO,YAAY,aAAa,SAAS;AAAA,IACzC,gBAAgB,YAAY,aAAa,kBAAkB;AAAA,IAC3D,OAAO,YAAY,aAAa,QAC5B;AAAA,MACE,KAAK,YAAY,YAAY,MAAM;AAAA,MACnC,SAAS,YAAY,YAAY,MAAM;AAAA,IACzC,IACA;AAAA,IACJ,iBAAiB,YAAY,aAAa,mBAAmB,CAAC;AAAA,EAChE;AAEA,SAAO;AAAA,IACL,IAAI,gBAAgB;AAAA,IACpB,UAAU,YAAY;AAAA,IACtB,aAAa,YAAY,eAAe;AAAA,IACxC,YAAY,YAAY,cAAc,CAAC;AAAA,IACvC,uBAAuB,YAAY,gBAC/B;AAAA,MACE,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,kBAAkB,CAAC;AAAA,MACnB,sBAAsB,EAAE,QAAQ,GAAG,cAAc,MAAM;AAAA,MACvD,8BAA8B,EAAE,QAAQ,GAAG,cAAc,MAAM;AAAA,IACjE,IACA;AAAA,EACN;AACF;",
   "names": []
 }

package/consent/script-snippets.js

@@ -110,10 +110,28 @@ gtag('config', '${id}');`
   },
   Northbeam: {
     defaultConsent: ["analytics", "marketing"],
+    // No trackPageViewInitial self-fire: NorthbeamSink owns every pageview
+    // (initial + soft navigations) via the NavigationTracker broadcast.
     buildTags: (id) => [
       {
         kind: "inline",
-        body: `(function(){var t;(n=t=t||{}).A="identify",n.B="trackPageView",n.C="fireEmailCaptureEvent",n.D="fireCustomGoal",n.E="firePurchaseEvent",n.F="trackPageViewInitial",n.G="fireSlimPurchaseEvent",n.H="identifyCustomerId";var n="https://j.northbeam.io/ota-sp/${id}.js";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement("script")).async=!0,a.src=n,document.head.appendChild(a),e.trackPageViewInitial(window.location.href);})()`
+        body: `(function(){var t;(n=t=t||{}).A="identify",n.B="trackPageView",n.C="fireEmailCaptureEvent",n.D="fireCustomGoal",n.E="firePurchaseEvent",n.F="trackPageViewInitial",n.G="fireSlimPurchaseEvent",n.H="identifyCustomerId";var n="https://j.northbeam.io/ota-sp/${id}.js";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement("script")).async=!0,a.src=n,document.head.appendChild(a);})()`
+      }
+    ]
+  },
+  Converge: {
+    defaultConsent: ["analytics", "marketing"],
+    // No $page_load self-fire: ConvergeSink owns every pageview (initial +
+    // soft navigations) via the NavigationTracker broadcast.
+    buildTags: (id) => [
+      {
+        kind: "external",
+        src: `https://static.runconverge.com/pixels/${id}.js`,
+        attributes: { async: "true" }
+      },
+      {
+        kind: "inline",
+        body: `window.cvg||(c=window.cvg=function(){c.process?c.process.apply(c,arguments):c.queue.push(arguments)},c.queue=[]);`
       }
     ]
   },

package/consent/script-snippets.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../consent/script-snippets.ts"],
-  "sourcesContent": ["import type {\n  ConsentCategory,\n  ReploScriptType,\n  ScriptTagDescriptor,\n} from \"schemas/generated/consent\";\n\n// Identifier providers: those whose script the runtime synthesizes from an ID.\n// `snippet` (pasted whole) and `custom` carry their own bodies instead.\n// Cookiebot's loader is built by its consent-platform preset, not here.\ntype ProviderType = Exclude<\n  ReploScriptType,\n  \"custom\" | \"snippet\" | \"consentPlatform\" | \"Cookiebot\"\n>;\n\n/**\n * Runtime-safe per-provider data for the consent system. This is the subset of\n * the website-builder miniapp's `scriptConstants.ts` that must ship in the\n * customer site bundle: how to materialize each provider's script tags, and the\n * default consent category that gates it. Miniapp-only concerns (LLM detection\n * schemas, logos, marketing copy) intentionally stay in the miniapp.\n *\n * Unlike the miniapp's `buildSnippet`, which returns a JSX *string* for the\n * agent to paste into `layout.tsx`, this returns structured descriptors so the\n * runtime can inject real DOM nodes (inline `<script>` bodies set via React's\n * `dangerouslySetInnerHTML` never execute).\n */\ntype ProviderSnippet = {\n  defaultConsent: ConsentCategory[];\n  buildTags: (identifier: string) => ScriptTagDescriptor[];\n};\n\n/**\n * NOTE (Ryan, 2026-05-28, REPL-27515): `defaultConsent` is net-new,\n * legally-sensitive categorization that does not exist elsewhere in the repo.\n * These are conservative defaults a customer can override per entry via\n * `requiredConsent`; container/CDP providers that fan out to multiple vendors\n * (GTM, Segment) require the union of categories they can serve.\n */\nconst PROVIDER_SNIPPETS: Record<ProviderType, ProviderSnippet> = {\n  GA4: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://www.googletagmanager.com/gtag/js?id=${id}`,\n      },\n      {\n        kind: \"inline\",\n        body: `window.dataLayer = window.dataLayer || [];\\nfunction gtag(){dataLayer.push(arguments);}\\ngtag('js', new Date());\\ngtag('config', '${id}');`,\n      },\n    ],\n  },\n  GoogleTagManager: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${id}');`,\n      },\n    ],\n  },\n  Meta: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${id}');fbq('track','PageView');`,\n      },\n    ],\n  },\n  TikTok: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=[\"page\",\"track\",\"identify\",\"instances\",\"debug\",\"on\",\"off\",\"once\",\"ready\",\"alias\",\"group\",\"enableCookie\",\"disableCookie\",\"holdConsent\",\"revokeConsent\",\"grantConsent\"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r=\"https://analytics.tiktok.com/i18n/pixel/events.js\",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var a=document.createElement(\"script\");a.type=\"text/javascript\",a.async=!0,a.src=r+\"?sdkid=\"+e+\"&lib=\"+t;var s=document.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(a,s)};ttq.load('${id}');ttq.page();}(window,document,'ttq');`,\n      },\n    ],\n  },\n  Pinterest: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version=\"3.0\";var t=document.createElement(\"script\");t.async=!0,t.src=e;var r=document.getElementsByTagName(\"script\")[0];r.parentNode.insertBefore(t,r)}}(\"https://s.pinimg.com/ct/core.js\");pintrk('load','${id}');pintrk('page');`,\n      },\n    ],\n  },\n  Reddit: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement(\"script\");t.src=\"https://www.redditstatic.com/ads/pixel.js\",t.async=!0;var s=d.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','${id}');rdt('track','PageVisit');`,\n      },\n    ],\n  },\n  Snapchat: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(e,t,n){if(e.snaptr)return;var a=e.snaptr=function(){a.handleRequest?a.handleRequest.apply(a,arguments):a.queue.push(arguments)};a.queue=[];var s='script';var r=t.createElement(s);r.async=!0;r.src=n;var u=t.getElementsByTagName(s)[0];u.parentNode.insertBefore(r,u);})(window,document,'https://sc-static.net/scevent.min.js');snaptr('init','${id}',{});snaptr('track','PAGE_VIEW');`,\n      },\n    ],\n  },\n  Hotjar: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(h,o,t,j,a,r){h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};h._hjSettings={hjid:${id},hjsv:6};a=o.getElementsByTagName('head')[0];r=o.createElement('script');r.async=1;r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;a.appendChild(r);})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');`,\n      },\n    ],\n  },\n  MicrosoftClarity: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);})(window,document,\"clarity\",\"script\",\"${id}\");`,\n      },\n    ],\n  },\n  Contentsquare: {\n    defaultConsent: [\"analytics\"],\n    // The UXA tag is a single async external script keyed by the 13-char tag id;\n    // it bootstraps the Contentsquare `_uxa` queue itself once loaded.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://t.contentsquare.net/uxa/${id}.js`,\n        attributes: { async: \"true\" },\n      },\n    ],\n  },\n  Segment: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(){var i=\"analytics\",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error(\"Segment snippet included twice.\");else{analytics.invoked=!0;analytics.methods=[\"trackSubmit\",\"trackClick\",\"trackLink\",\"trackForm\",\"pageview\",\"identify\",\"reset\",\"group\",\"track\",\"ready\",\"alias\",\"debug\",\"page\",\"screen\",\"once\",\"off\",\"on\",\"addSourceMiddleware\",\"addIntegrationMiddleware\",\"setAnonymousId\",\"addDestinationMiddleware\",\"register\"];analytics.factory=function(e){return function(){var t=Array.prototype.slice.call(arguments);t.unshift(e);analytics.push(t);return analytics}};for(var e=0;e<analytics.methods.length;e++){var key=analytics.methods[e];analytics[key]=analytics.factory(key)}analytics.load=function(key,e){var t=document.createElement(\"script\");t.type=\"text/javascript\";t.async=!0;t.src=\"https://cdn.segment.com/analytics.js/v1/\"+key+\"/analytics.min.js\";var n=document.getElementsByTagName(\"script\")[0];n.parentNode.insertBefore(t,n);analytics._loadOptions=e};analytics._writeKey=\"${id}\";analytics.SNIPPET_VERSION=\"5.2.0\";analytics.load(\"${id}\");analytics.page();}}();`,\n      },\n    ],\n  },\n  Northbeam: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(){var t;(n=t=t||{}).A=\"identify\",n.B=\"trackPageView\",n.C=\"fireEmailCaptureEvent\",n.D=\"fireCustomGoal\",n.E=\"firePurchaseEvent\",n.F=\"trackPageViewInitial\",n.G=\"fireSlimPurchaseEvent\",n.H=\"identifyCustomerId\";var n=\"https://j.northbeam.io/ota-sp/${id}.js\";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement(\"script\")).async=!0,a.src=n,document.head.appendChild(a),e.trackPageViewInitial(window.location.href);})()`,\n      },\n    ],\n  },\n  Gorgias: {\n    // Support chat stores the visitor's chat session, which is a functional\n    // preference rather than analytics or ad tracking.\n    defaultConsent: [\"preferences\"],\n    // The id attribute matches Gorgias's official v3 install snippet; their\n    // customization scripts and support tooling look the tag up by that id.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://config.gorgias.chat/bundle-loader/${id}`,\n        attributes: { id: \"gorgias-chat-widget-install-v3\" },\n      },\n    ],\n  },\n};\n\n/**\n * Snippet providers don't synthesize tags (the user pastes the provider-issued\n * snippet as the entry's `body`), but they still get a first-class default\n * consent categorization like identifier providers.\n */\n/**\n * Returns the structured tag descriptors for a named provider. A single provider\n * can produce multiple tags (e.g. GA4 = external loader + inline config), which\n * the runtime injects in order.\n */\nexport function buildScriptTags({\n  type,\n  identifier,\n}: {\n  type: ProviderType;\n  identifier: string;\n}): ScriptTagDescriptor[] {\n  return PROVIDER_SNIPPETS[type].buildTags(identifier);\n}\n\n/**\n * The default consent categories that gate an identifier-provider script when an\n * entry does not specify `requiredConsent`. `snippet` and `custom` entries carry\n * `requiredConsent` explicitly (the runtime has no default for them), so this is\n * only consulted for identifier providers. Overridable per entry by the customer.\n */\nexport function defaultConsentFor(type: ProviderType): ConsentCategory[] {\n  return PROVIDER_SNIPPETS[type].defaultConsent;\n}\n"],
-  "mappings": "AAsCA,MAAM,oBAA2D;AAAA,EAC/D,KAAK;AAAA,IACH,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,+CAA+C,EAAE;AAAA,MACxD;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA;AAAA;AAAA,kBAAqI,EAAE;AAAA,MAC/I;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,sUAAsU,EAAE;AAAA,MAChV;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,uYAAuY,EAAE;AAAA,MACjZ;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+7BAA+7B,EAAE;AAAA,MACz8B;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,0WAA0W,EAAE;AAAA,MACpX;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gVAAgV,EAAE;AAAA,MAC1V;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+VAA+V,EAAE;AAAA,MACzW;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,yGAAyG,EAAE;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iQAAiQ,EAAE;AAAA,MAC3Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,gBAAgB,CAAC,WAAW;AAAA;AAAA;AAAA,IAG5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,mCAAmC,EAAE;AAAA,QAC1C,YAAY,EAAE,OAAO,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iiCAAiiC,EAAE,uDAAuD,EAAE;AAAA,MACpmC;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gQAAgQ,EAAE;AAAA,MAC1Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA;AAAA;AAAA,IAGP,gBAAgB,CAAC,aAAa;AAAA;AAAA;AAAA,IAG9B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,6CAA6C,EAAE;AAAA,QACpD,YAAY,EAAE,IAAI,iCAAiC;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAG0B;AACxB,SAAO,kBAAkB,IAAI,EAAE,UAAU,UAAU;AACrD;AAQO,SAAS,kBAAkB,MAAuC;AACvE,SAAO,kBAAkB,IAAI,EAAE;AACjC;",
+  "sourcesContent": ["import type {\n  ConsentCategory,\n  ReploScriptType,\n  ScriptTagDescriptor,\n} from \"schemas/generated/consent\";\n\n// Identifier providers: those whose script the runtime synthesizes from an ID.\n// `snippet` (pasted whole) and `custom` carry their own bodies instead.\n// Cookiebot's loader is built by its consent-platform preset, not here.\ntype ProviderType = Exclude<\n  ReploScriptType,\n  \"custom\" | \"snippet\" | \"consentPlatform\" | \"Cookiebot\"\n>;\n\n/**\n * Runtime-safe per-provider data for the consent system. This is the subset of\n * the website-builder miniapp's `scriptConstants.ts` that must ship in the\n * customer site bundle: how to materialize each provider's script tags, and the\n * default consent category that gates it. Miniapp-only concerns (LLM detection\n * schemas, logos, marketing copy) intentionally stay in the miniapp.\n *\n * Unlike the miniapp's `buildSnippet`, which returns a JSX *string* for the\n * agent to paste into `layout.tsx`, this returns structured descriptors so the\n * runtime can inject real DOM nodes (inline `<script>` bodies set via React's\n * `dangerouslySetInnerHTML` never execute).\n */\ntype ProviderSnippet = {\n  defaultConsent: ConsentCategory[];\n  buildTags: (identifier: string) => ScriptTagDescriptor[];\n};\n\n/**\n * NOTE (Ryan, 2026-05-28, REPL-27515): `defaultConsent` is net-new,\n * legally-sensitive categorization that does not exist elsewhere in the repo.\n * These are conservative defaults a customer can override per entry via\n * `requiredConsent`; container/CDP providers that fan out to multiple vendors\n * (GTM, Segment) require the union of categories they can serve.\n */\nconst PROVIDER_SNIPPETS: Record<ProviderType, ProviderSnippet> = {\n  GA4: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://www.googletagmanager.com/gtag/js?id=${id}`,\n      },\n      {\n        kind: \"inline\",\n        body: `window.dataLayer = window.dataLayer || [];\\nfunction gtag(){dataLayer.push(arguments);}\\ngtag('js', new Date());\\ngtag('config', '${id}');`,\n      },\n    ],\n  },\n  GoogleTagManager: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${id}');`,\n      },\n    ],\n  },\n  Meta: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${id}');fbq('track','PageView');`,\n      },\n    ],\n  },\n  TikTok: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=[\"page\",\"track\",\"identify\",\"instances\",\"debug\",\"on\",\"off\",\"once\",\"ready\",\"alias\",\"group\",\"enableCookie\",\"disableCookie\",\"holdConsent\",\"revokeConsent\",\"grantConsent\"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r=\"https://analytics.tiktok.com/i18n/pixel/events.js\",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var a=document.createElement(\"script\");a.type=\"text/javascript\",a.async=!0,a.src=r+\"?sdkid=\"+e+\"&lib=\"+t;var s=document.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(a,s)};ttq.load('${id}');ttq.page();}(window,document,'ttq');`,\n      },\n    ],\n  },\n  Pinterest: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version=\"3.0\";var t=document.createElement(\"script\");t.async=!0,t.src=e;var r=document.getElementsByTagName(\"script\")[0];r.parentNode.insertBefore(t,r)}}(\"https://s.pinimg.com/ct/core.js\");pintrk('load','${id}');pintrk('page');`,\n      },\n    ],\n  },\n  Reddit: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement(\"script\");t.src=\"https://www.redditstatic.com/ads/pixel.js\",t.async=!0;var s=d.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','${id}');rdt('track','PageVisit');`,\n      },\n    ],\n  },\n  Snapchat: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(e,t,n){if(e.snaptr)return;var a=e.snaptr=function(){a.handleRequest?a.handleRequest.apply(a,arguments):a.queue.push(arguments)};a.queue=[];var s='script';var r=t.createElement(s);r.async=!0;r.src=n;var u=t.getElementsByTagName(s)[0];u.parentNode.insertBefore(r,u);})(window,document,'https://sc-static.net/scevent.min.js');snaptr('init','${id}',{});snaptr('track','PAGE_VIEW');`,\n      },\n    ],\n  },\n  Hotjar: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(h,o,t,j,a,r){h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};h._hjSettings={hjid:${id},hjsv:6};a=o.getElementsByTagName('head')[0];r=o.createElement('script');r.async=1;r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;a.appendChild(r);})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');`,\n      },\n    ],\n  },\n  MicrosoftClarity: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);})(window,document,\"clarity\",\"script\",\"${id}\");`,\n      },\n    ],\n  },\n  Contentsquare: {\n    defaultConsent: [\"analytics\"],\n    // The UXA tag is a single async external script keyed by the 13-char tag id;\n    // it bootstraps the Contentsquare `_uxa` queue itself once loaded.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://t.contentsquare.net/uxa/${id}.js`,\n        attributes: { async: \"true\" },\n      },\n    ],\n  },\n  Segment: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(){var i=\"analytics\",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error(\"Segment snippet included twice.\");else{analytics.invoked=!0;analytics.methods=[\"trackSubmit\",\"trackClick\",\"trackLink\",\"trackForm\",\"pageview\",\"identify\",\"reset\",\"group\",\"track\",\"ready\",\"alias\",\"debug\",\"page\",\"screen\",\"once\",\"off\",\"on\",\"addSourceMiddleware\",\"addIntegrationMiddleware\",\"setAnonymousId\",\"addDestinationMiddleware\",\"register\"];analytics.factory=function(e){return function(){var t=Array.prototype.slice.call(arguments);t.unshift(e);analytics.push(t);return analytics}};for(var e=0;e<analytics.methods.length;e++){var key=analytics.methods[e];analytics[key]=analytics.factory(key)}analytics.load=function(key,e){var t=document.createElement(\"script\");t.type=\"text/javascript\";t.async=!0;t.src=\"https://cdn.segment.com/analytics.js/v1/\"+key+\"/analytics.min.js\";var n=document.getElementsByTagName(\"script\")[0];n.parentNode.insertBefore(t,n);analytics._loadOptions=e};analytics._writeKey=\"${id}\";analytics.SNIPPET_VERSION=\"5.2.0\";analytics.load(\"${id}\");analytics.page();}}();`,\n      },\n    ],\n  },\n  Northbeam: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    // No trackPageViewInitial self-fire: NorthbeamSink owns every pageview\n    // (initial + soft navigations) via the NavigationTracker broadcast.\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(){var t;(n=t=t||{}).A=\"identify\",n.B=\"trackPageView\",n.C=\"fireEmailCaptureEvent\",n.D=\"fireCustomGoal\",n.E=\"firePurchaseEvent\",n.F=\"trackPageViewInitial\",n.G=\"fireSlimPurchaseEvent\",n.H=\"identifyCustomerId\";var n=\"https://j.northbeam.io/ota-sp/${id}.js\";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement(\"script\")).async=!0,a.src=n,document.head.appendChild(a);})()`,\n      },\n    ],\n  },\n  Converge: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    // No $page_load self-fire: ConvergeSink owns every pageview (initial +\n    // soft navigations) via the NavigationTracker broadcast.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://static.runconverge.com/pixels/${id}.js`,\n        attributes: { async: \"true\" },\n      },\n      {\n        kind: \"inline\",\n        body: `window.cvg||(c=window.cvg=function(){c.process?c.process.apply(c,arguments):c.queue.push(arguments)},c.queue=[]);`,\n      },\n    ],\n  },\n  Gorgias: {\n    // Support chat stores the visitor's chat session, which is a functional\n    // preference rather than analytics or ad tracking.\n    defaultConsent: [\"preferences\"],\n    // The id attribute matches Gorgias's official v3 install snippet; their\n    // customization scripts and support tooling look the tag up by that id.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://config.gorgias.chat/bundle-loader/${id}`,\n        attributes: { id: \"gorgias-chat-widget-install-v3\" },\n      },\n    ],\n  },\n};\n\n/**\n * Snippet providers don't synthesize tags (the user pastes the provider-issued\n * snippet as the entry's `body`), but they still get a first-class default\n * consent categorization like identifier providers.\n */\n/**\n * Returns the structured tag descriptors for a named provider. A single provider\n * can produce multiple tags (e.g. GA4 = external loader + inline config), which\n * the runtime injects in order.\n */\nexport function buildScriptTags({\n  type,\n  identifier,\n}: {\n  type: ProviderType;\n  identifier: string;\n}): ScriptTagDescriptor[] {\n  return PROVIDER_SNIPPETS[type].buildTags(identifier);\n}\n\n/**\n * The default consent categories that gate an identifier-provider script when an\n * entry does not specify `requiredConsent`. `snippet` and `custom` entries carry\n * `requiredConsent` explicitly (the runtime has no default for them), so this is\n * only consulted for identifier providers. Overridable per entry by the customer.\n */\nexport function defaultConsentFor(type: ProviderType): ConsentCategory[] {\n  return PROVIDER_SNIPPETS[type].defaultConsent;\n}\n"],
+  "mappings": "AAsCA,MAAM,oBAA2D;AAAA,EAC/D,KAAK;AAAA,IACH,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,+CAA+C,EAAE;AAAA,MACxD;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA;AAAA;AAAA,kBAAqI,EAAE;AAAA,MAC/I;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,sUAAsU,EAAE;AAAA,MAChV;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,uYAAuY,EAAE;AAAA,MACjZ;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+7BAA+7B,EAAE;AAAA,MACz8B;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,0WAA0W,EAAE;AAAA,MACpX;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gVAAgV,EAAE;AAAA,MAC1V;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+VAA+V,EAAE;AAAA,MACzW;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,yGAAyG,EAAE;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iQAAiQ,EAAE;AAAA,MAC3Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,gBAAgB,CAAC,WAAW;AAAA;AAAA;AAAA,IAG5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,mCAAmC,EAAE;AAAA,QAC1C,YAAY,EAAE,OAAO,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iiCAAiiC,EAAE,uDAAuD,EAAE;AAAA,MACpmC;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,aAAa,WAAW;AAAA;AAAA;AAAA,IAGzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gQAAgQ,EAAE;AAAA,MAC1Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,aAAa,WAAW;AAAA;AAAA;AAAA,IAGzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,yCAAyC,EAAE;AAAA,QAChD,YAAY,EAAE,OAAO,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA;AAAA;AAAA,IAGP,gBAAgB,CAAC,aAAa;AAAA;AAAA;AAAA,IAG9B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,6CAA6C,EAAE;AAAA,QACpD,YAAY,EAAE,IAAI,iCAAiC;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAG0B;AACxB,SAAO,kBAAkB,IAAI,EAAE,UAAU,UAAU;AACrD;AAQO,SAAS,kBAAkB,MAAuC;AACvE,SAAO,kBAAkB,IAAI,EAAE;AACjC;",
   "names": []
 }

package/consent/types.d.ts

@@ -1,4 +1,4 @@
-export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Cookiebot" | "snippet" | "custom" | "consentPlatform";
+export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "Cookiebot" | "snippet" | "custom" | "consentPlatform";
 export type ConsentCategory = "necessary" | "analytics" | "marketing" | "preferences" | "sale_of_data";
 export type ConsentMode = "off" | "simple" | "per-category";
 declare module "react" {
@@ -17,7 +17,7 @@ export type ScriptTagDescriptor = {
     body: string;
 };
 export type ReploScriptEntry = {
-    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Cookiebot";
+    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "Cookiebot";
     identifier: string;
     requiredConsent?: ConsentCategory[];
 } | {

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "0.10.0",
+  "version": "0.13.0",
   "branch": "HEAD",
-  "commit": "ea63e9b4d8aa2ba26cbbf1809df8fbf4d26b4d82",
-  "builtAt": "2026-08-21T16:44:54.297Z"
+  "commit": "56e0eef69efd5e5baff88bcd4428e1b34adcc765",
+  "builtAt": "2026-08-26T20:40:22.478Z"
 };

package/loaders/loader-keys.d.ts

@@ -27,6 +27,8 @@ export declare const DATA_LOADER_KEYS: {
     readonly YOTPO_PRODUCT_REVIEW_AGGREGATE: "yotpo.product_review_aggregate";
     readonly REVIEWS_IO_PRODUCT_REVIEWS: "reviews_io.product_reviews";
     readonly REVIEWS_IO_PRODUCT_REVIEW_AGGREGATE: "reviews_io.product_review_aggregate";
+    readonly LOOX_PRODUCT_REVIEWS: "loox.product_reviews";
+    readonly LOOX_PRODUCT_REVIEW_AGGREGATE: "loox.product_review_aggregate";
     readonly STATSIG_EXPERIMENT: "statsig.experiment";
     readonly CONTENTFUL_ENTRY: "contentful.entry";
     readonly CONTENTFUL_ENTRIES: "contentful.entries";

package/loaders/loader-keys.js

@@ -16,6 +16,8 @@ const DATA_LOADER_KEYS = {
   YOTPO_PRODUCT_REVIEW_AGGREGATE: "yotpo.product_review_aggregate",
   REVIEWS_IO_PRODUCT_REVIEWS: "reviews_io.product_reviews",
   REVIEWS_IO_PRODUCT_REVIEW_AGGREGATE: "reviews_io.product_review_aggregate",
+  LOOX_PRODUCT_REVIEWS: "loox.product_reviews",
+  LOOX_PRODUCT_REVIEW_AGGREGATE: "loox.product_review_aggregate",
   STATSIG_EXPERIMENT: "statsig.experiment",
   CONTENTFUL_ENTRY: "contentful.entry",
   CONTENTFUL_ENTRIES: "contentful.entries"

package/loaders/loader-keys.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../loaders/loader-keys.ts"],
-  "sourcesContent": ["// NOTE (Ryan, 2026-07-23, REPL-27611): Canonical loader-key constants for the\n// published-page surface. the SDK owns this copy so nothing shipped to a\n// generated site imports from `schemas`. The backend keeps its own copy in\n// `schemas/loaderKeys.ts` (consumed by the integration registry + tool\n// metadata, which cannot depend on the SDK without a cycle); the two are\n// kept in lockstep by the drift guard in `loader-keys.spec.ts`.\n\n/**\n * Shared data-loader key constants. Loader components and prefetch queries\n * import from here so the strings are never duplicated across a generated site.\n *\n * These keys serve double duty: they identify which backend loader to invoke\n * AND are used as React Query cache key prefixes. Loader components internally\n * construct queryKey as `[loaderKey, args]`.\n *\n * Naming convention: `<integration>.<objectType>` or\n * `<integration>.<objectType>_<qualifier>`.\n */\nexport const DATA_LOADER_KEYS = {\n  SHOPIFY_PRODUCT: \"shopify_storefront.product\",\n  SHOPIFY_COLLECTION: \"shopify_storefront.collection\",\n  SHOPIFY_COLLECTION_PRODUCTS: \"shopify_storefront.collection_products\",\n  SHOPIFY_METAOBJECT: \"shopify_storefront.metaobject\",\n  SHOPIFY_METAOBJECTS: \"shopify_storefront.metaobjects\",\n  REPLO_PRODUCT: \"replo_products.product\",\n  OKENDO_PRODUCT_REVIEWS: \"okendo.product_reviews\",\n  OKENDO_PRODUCT_REVIEW_AGGREGATE: \"okendo.product_review_aggregate\",\n  REBUY_RECOMMENDATIONS: \"rebuy.recommendations\",\n  LEVANTA_PRODUCT: \"levanta_products.product\",\n  SMILE_IO_VIP_TIERS: \"smile_io.vip_tiers\",\n  SMILE_IO_EARNING_RULES: \"smile_io.earning_rules\",\n  SMILE_IO_REWARDS: \"smile_io.rewards\",\n  YOTPO_PRODUCT_REVIEWS: \"yotpo.product_reviews\",\n  YOTPO_PRODUCT_REVIEW_AGGREGATE: \"yotpo.product_review_aggregate\",\n  REVIEWS_IO_PRODUCT_REVIEWS: \"reviews_io.product_reviews\",\n  REVIEWS_IO_PRODUCT_REVIEW_AGGREGATE: \"reviews_io.product_review_aggregate\",\n  STATSIG_EXPERIMENT: \"statsig.experiment\",\n  CONTENTFUL_ENTRY: \"contentful.entry\",\n  CONTENTFUL_ENTRIES: \"contentful.entries\",\n} as const;\n\nexport type DataLoaderKey =\n  (typeof DATA_LOADER_KEYS)[keyof typeof DATA_LOADER_KEYS];\n"],
-  "mappings": "AAkBO,MAAM,mBAAmB;AAAA,EAC9B,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,6BAA6B;AAAA,EAC7B,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,wBAAwB;AAAA,EACxB,iCAAiC;AAAA,EACjC,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,gCAAgC;AAAA,EAChC,4BAA4B;AAAA,EAC5B,qCAAqC;AAAA,EACrC,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,oBAAoB;AACtB;",
+  "sourcesContent": ["// NOTE (Ryan, 2026-07-23, REPL-27611): Canonical loader-key constants for the\n// published-page surface. the SDK owns this copy so nothing shipped to a\n// generated site imports from `schemas`. The backend keeps its own copy in\n// `schemas/loaderKeys.ts` (consumed by the integration registry + tool\n// metadata, which cannot depend on the SDK without a cycle); the two are\n// kept in lockstep by the drift guard in `loader-keys.spec.ts`.\n\n/**\n * Shared data-loader key constants. Loader components and prefetch queries\n * import from here so the strings are never duplicated across a generated site.\n *\n * These keys serve double duty: they identify which backend loader to invoke\n * AND are used as React Query cache key prefixes. Loader components internally\n * construct queryKey as `[loaderKey, args]`.\n *\n * Naming convention: `<integration>.<objectType>` or\n * `<integration>.<objectType>_<qualifier>`.\n */\nexport const DATA_LOADER_KEYS = {\n  SHOPIFY_PRODUCT: \"shopify_storefront.product\",\n  SHOPIFY_COLLECTION: \"shopify_storefront.collection\",\n  SHOPIFY_COLLECTION_PRODUCTS: \"shopify_storefront.collection_products\",\n  SHOPIFY_METAOBJECT: \"shopify_storefront.metaobject\",\n  SHOPIFY_METAOBJECTS: \"shopify_storefront.metaobjects\",\n  REPLO_PRODUCT: \"replo_products.product\",\n  OKENDO_PRODUCT_REVIEWS: \"okendo.product_reviews\",\n  OKENDO_PRODUCT_REVIEW_AGGREGATE: \"okendo.product_review_aggregate\",\n  REBUY_RECOMMENDATIONS: \"rebuy.recommendations\",\n  LEVANTA_PRODUCT: \"levanta_products.product\",\n  SMILE_IO_VIP_TIERS: \"smile_io.vip_tiers\",\n  SMILE_IO_EARNING_RULES: \"smile_io.earning_rules\",\n  SMILE_IO_REWARDS: \"smile_io.rewards\",\n  YOTPO_PRODUCT_REVIEWS: \"yotpo.product_reviews\",\n  YOTPO_PRODUCT_REVIEW_AGGREGATE: \"yotpo.product_review_aggregate\",\n  REVIEWS_IO_PRODUCT_REVIEWS: \"reviews_io.product_reviews\",\n  REVIEWS_IO_PRODUCT_REVIEW_AGGREGATE: \"reviews_io.product_review_aggregate\",\n  LOOX_PRODUCT_REVIEWS: \"loox.product_reviews\",\n  LOOX_PRODUCT_REVIEW_AGGREGATE: \"loox.product_review_aggregate\",\n  STATSIG_EXPERIMENT: \"statsig.experiment\",\n  CONTENTFUL_ENTRY: \"contentful.entry\",\n  CONTENTFUL_ENTRIES: \"contentful.entries\",\n} as const;\n\nexport type DataLoaderKey =\n  (typeof DATA_LOADER_KEYS)[keyof typeof DATA_LOADER_KEYS];\n"],
+  "mappings": "AAkBO,MAAM,mBAAmB;AAAA,EAC9B,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,6BAA6B;AAAA,EAC7B,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,wBAAwB;AAAA,EACxB,iCAAiC;AAAA,EACjC,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,gCAAgC;AAAA,EAChC,4BAA4B;AAAA,EAC5B,qCAAqC;AAAA,EACrC,sBAAsB;AAAA,EACtB,+BAA+B;AAAA,EAC/B,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,oBAAoB;AACtB;",
   "names": []
 }

package/loaders/loader-schemas.d.ts

@@ -795,6 +795,46 @@ export declare const reviewsIoProductReviewAggregateLoaderOutputSchema: z.ZodObj
     reviewCount: z.ZodNumber;
     reviewAverageValue: z.ZodNumber;
 }, z.core.$strip>;
+export declare const looxReviewMediaSchema: z.ZodObject<{
+    type: z.ZodNullable<z.ZodString>;
+    url: z.ZodString;
+    thumbnailUrl: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const looxReviewLoaderItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    rating: z.ZodNullable<z.ZodNumber>;
+    body: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodNullable<z.ZodString>;
+    verified: z.ZodBoolean;
+    reviewerName: z.ZodNullable<z.ZodString>;
+    productName: z.ZodNullable<z.ZodString>;
+    media: z.ZodArray<z.ZodObject<{
+        type: z.ZodNullable<z.ZodString>;
+        url: z.ZodString;
+        thumbnailUrl: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const looxProductReviewsLoaderOutputSchema: z.ZodObject<{
+    reviews: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        rating: z.ZodNullable<z.ZodNumber>;
+        body: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodNullable<z.ZodString>;
+        verified: z.ZodBoolean;
+        reviewerName: z.ZodNullable<z.ZodString>;
+        productName: z.ZodNullable<z.ZodString>;
+        media: z.ZodArray<z.ZodObject<{
+            type: z.ZodNullable<z.ZodString>;
+            url: z.ZodString;
+            thumbnailUrl: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const looxProductReviewAggregateLoaderOutputSchema: z.ZodObject<{
+    totalReviews: z.ZodNumber;
+    averageRating: z.ZodNumber;
+    ratingDistribution: z.ZodRecord<z.ZodString, z.ZodNumber>;
+}, z.core.$strip>;
 export declare const statsigExperimentLoaderOutputSchema: z.ZodObject<{
     experimentName: z.ZodString;
     groupName: z.ZodNullable<z.ZodString>;

package/loaders/loader-schemas.js

@@ -248,6 +248,29 @@ const reviewsIoProductReviewAggregateLoaderOutputSchema = z.object({
   reviewCount: z.number(),
   reviewAverageValue: z.number()
 });
+const looxReviewMediaSchema = z.object({
+  type: z.string().nullable(),
+  url: z.string(),
+  thumbnailUrl: z.string().nullable()
+});
+const looxReviewLoaderItemSchema = z.object({
+  id: z.string(),
+  rating: z.number().nullable(),
+  body: z.string().nullable(),
+  createdAt: z.string().nullable(),
+  verified: z.boolean(),
+  reviewerName: z.string().nullable(),
+  productName: z.string().nullable(),
+  media: z.array(looxReviewMediaSchema)
+});
+const looxProductReviewsLoaderOutputSchema = z.object({
+  reviews: z.array(looxReviewLoaderItemSchema)
+});
+const looxProductReviewAggregateLoaderOutputSchema = z.object({
+  totalReviews: z.number(),
+  averageRating: z.number(),
+  ratingDistribution: z.record(z.string(), z.number())
+});
 const statsigExperimentLoaderOutputSchema = z.object({
   experimentName: z.string(),
   groupName: z.string().nullable().describe("The assigned variant group name (e.g. Control, Test)."),
@@ -320,6 +343,10 @@ export {
   fullVariantSchema,
   imageSchema,
   levantaProductFullSchema,
+  looxProductReviewAggregateLoaderOutputSchema,
+  looxProductReviewsLoaderOutputSchema,
+  looxReviewLoaderItemSchema,
+  looxReviewMediaSchema,
   mediaImageSchema,
   mediaSchema,
   metafieldSchema,